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Abstract — Identification  and  isolation  of  attackers  in  a  dis¬ 
tributed  system  is  a  challenging  problem.  This  problem  is  even 
more  aggravated  in  a  wireless  network  because  the  unreliable 
channel  makes  the  actions  of  the  users  (nodes)  hidden  from 
each  other.  Therefore,  legitimate  users  can  only  construct  a  belief 
about  a  potential  attacker  through  monitoring  and  observation. 
In  this  paper,  we  use  game  theory  to  study  the  interactions 
between  regular  and  attacker  nodes  in  a  wireless  network.  We 
model  the  attacker  node  detection  process  as  a  Bayesian  game 
with  Imperfect  information  and  show  that  a  mixed  strategy 
perfect  Bayesian  Nash  Equilibrium  is  attainable.  Further,  we 
show  how  an  attacker  node  can  construct  a  nested  belief  system 
to  predict  the  belief  held  by  a  regular  node.  By  employing  the 
nested  belief  system,  a  Markov  Perfect  Bayes-Nash  Equilibrium 
is  reached  and  the  equilibrium  postpones  the  detection  of  the 
attacker  node.  Simulation  results  and  their  discussions  are 
provided  to  illustrate  the  properties  of  the  derived  equilibria. 

I.  Introduction 

In  a  wireless  network,  the  entities  (nodes)  in  the  network 
require  direct  and/or  indirect  data  exchange  via  the  network, 
thus  it  is  of  great  importance  to  ensure  communication  secu¬ 
rity,  data  integrity,  and  information  fidelity.  Although  advanced 
cryptographic  techniques  can  be  employed,  the  security  chal¬ 
lenges,  e.g.,  DoS  attacks,  in  wireless  networks  are  not  fully 
addressed.  It  is  partially  due  to  the  distributed  nature  of  the 
network  and  centralized  security  approaches  are  sometimes 
limited  or  inappropriated.  Therefore,  it  is  quite  desirable  that 
security  schemes  can  be  designed  from  a  node’s  perspective. 

As  far  as  the  attacks  in  wireless  networks  are  concerned,  in 
order  to  minimize  the  impact  of  the  attackers,  detection  mecha¬ 
nisms  need  to  be  in  place.  Therefore,  a  legitimate/regular  node 
should  monitor  its  surroundings  and  distinguish  a  malicious 
attacker  from  a  regular  one.  However,  the  detection  process  has 
the  following  three  challenges,  (i)  monitoring  can  be  costly. 
To  identify  the  malice,  a  regular  node  has  to  listen  to  the 
channel  and/or  process  the  information  sent  by  the  nodes 
being  monitored.  Listening  and  processing  consume  resources 
and  hence,  monitoring  all  the  times  is  not  efficient  even  if 
plausible,  (ii)  the  attacker  can  camouflage  itself.  To  reduce 
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the  probability  of  being  detected,  an  attacker  can  behave  like  a 
regular  node  and  choose  longer  intervals  between  attacks,  (iii) 
the  randomness  and  unreliability  of  the  wireless  channel  bring 
more  uncertainty  to  the  monitoring  and  detection  process. 

To  make  the  process  of  detection  even  more  difficult,  the 
attackers  do  not  act  passively  and  wait  to  be  detected.  Instead, 
they  also  study  the  interaction  they  have  with  the  rest  of 
the  network  and  adjust  their  subsequent  actions  accordingly. 
It  is  also  possible  that  an  attacker  is  wise  enough  to  learn 
and  predict  the  actions  of  the  regular  nodes  to  assist  itself 
in  decision  making.  The  options  available  to  the  attackers 
complicate  the  solution  space  and  bring  more  challenges  to 
the  detection  process. 

To  model  the  interaction  among  the  attackers  and  regular 
nodes  in  the  network,  game  theory  [4],  [11]  is  introduced  as 
a  tool.  Recently,  game  theory  has  been  successfully  applied 
to  solve  various  problems  in  wireless  networks  [3],  [5],  [7], 
[10],  [12],  [14].  In  the  context  of  attack/intrusion  detection, 
much  work  has  been  done  that  investigates  the  games  played 
between  the  regular  and  attacker  nodes.  Kodialam  et.  al. 
formally  propose  a  game  theoretic  framework  to  model  how 
a  service  provider  detects  an  intruder  [6].  However,  their  as¬ 
sumptions  of  zero-sum  game  and  complete,  perfect  knowledge 
have  limitations.  Agah  et.  al.  study  the  non-zero-sum  intrusion 
detection  game  in  [1];  their  results  infer  the  optimal  strategies 
in  one-stage  static  game  with  complete  information.  In  [9], 
Liu  et.  al.  propose  a  Bayesian  hybrid  detection  approach  to 
detect  intrusion  in  wireless  ad  hoc  networks.  They  design 
an  energy  efficient  detection  procedure  while  improving  the 
overall  detection  power.  The  intrusion  detection  game  with 
networked  devices  are  investigated  in  [15],  where  Zhu  et.  al. 
introduce  an  N-person  non-cooperative  game  to  study  incen¬ 
tive  compatibility  of  the  collaborative  detection.  [8]  models 
the  intention  and  strategies  of  a  malicious  attacker  through  an 
incentive-based  approach.  Cooperative  game  theory  is  applied 
in  [2],  where  Alpcan  and  Bagar  model  the  game  as  dynamic 
two-person,  non-zero-sum  and  finite.  While  existing  work 
focus  on  various  aspects  of  the  detection  process,  the  noise 
in  observation  has  not  been  fully  addressed. 

In  this  paper  we  use  game  theory  to  capture  and  analyze 
the  interactions  between  an  attacker  and  a  regular  node. 
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In  particular,  we  formalize  the  interactions  as  a  attacker 
detection  game,  which  is  a  Bayesian  game  with  imperfect 
information.  The  information  is  hidden  because  the  attacker 
can  camouflage  as  a  regular  node  and  the  actions  are  hidden 
due  to  the  noise  and  imperfect  observation.  To  address  the 
possible  countermeasures  the  attacker  might  take,  we  propose 
a  nested  belief  model.  In  this  model,  the  attacker  learns 
from  its  private  observations  and  predicts  if  the  regular  node 
has  accumulated  enough  information  to  make  the  detection. 
Associated  with  the  belief,  we  show  that  a  Markov  Perfect 
Bayes-Nash  Equilibrium  emerges.  We  also  provide  simulation 
study  to  support  the  efficiency  and  other  properties  of  the 
equilibria. 

The  rest  of  the  paper  is  organized  as  follows.  In  Section  II, 
we  briefly  review  the  basic  concepts  of  game  theory  that  are 
used  in  our  research.  Section  III  presents  the  attacker  detection 
game  in  which  we  model,  analyze  and  solve  some  Bayes 
games  in  order  to  obtain  equilibrium  solutions.  Simulation 
results  are  shown  in  Section  IV  to  characterize  the  equilibrium 
properties.  The  last  section  concludes  the  paper. 

II.  Basic  Concepts  in  Game  Theory 

Game  theory  offers  powerful  tools  in  modeling  and  ana¬ 
lyzing  conflicts  and  cooperation  among  multiple  players  in 
a  system  with  regard  to  strategic  decision  making.  In  this 
section,  we  review  some  of  the  fundamental  concepts  in  game 
theory  that  will  be  used  and  applied  throughout  this  paper.  We 
begin  with  the  definition  of  games  and  equilibrium. 

Deeinition  1 :  A  game  T  is  a  tuple  (/,  S,  u),  where 

•  /  =  1,2,  ...,n  denotes  a  set  of  players/nodes. 

•  S  =  Xi^jSi  is  a  space  of  strategy  profiles.  It  is  the 
cartesian  product  of  strategy  profile  Si  for  each  of  the 
player  i. 

•  M  is  a  vector  of  von  Neumann-Morgenstern  utility  func¬ 
tions  defined  over  S.  For  a  particular  strategy  profile  s, 
u(s)  =  {ui{s),U2{s),  ■■■Ui{s))  is  called  a  payoff  vector 
consists  of  individual  payoffs  Ui{s). 

Often  times,  player  i  is  interested  in  what  strategies  the  rest  of 
the  players  in  the  game  take.  We  denote  the  deleted  strategy 
profile  S-i  =  (si, ...,  Si_i,  Si+i, ...,  s„).  We  assume  that  all 
players  in  the  game  are  rational.  A  rational  player  chooses 
actions  to  maximize  her  expected  utility  (payoffs). 

Deeinition  2:  The  strategy  profile  s*  is  a  Nash  Equilib¬ 
rium,  if 

Ui(s*)  >  Ui{si,s'Li)  for  every  strategy  Si  of  player  i. 

The  underlying  assumption  of  Nash  Equilibrium  is  that  each 
player  holds  the  correct  belief  about  other  players’  actions. 
However,  in  many  situations,  players  in  the  game  are  not  per¬ 
fectly  informed  about  about  their  opponents’  characteristics. 
This  type  of  games  falls  into  the  category  of  incomplete  infor¬ 
mation  games,  and  the  notion  of  Bayesian  game  is  introduced. 

Deeinition  3:  A  Bayesian  game  consists  of  a  set  of  play¬ 
ers  and  states,  for  each  player,  a  set  of  signals  is  associated 
with  each  of  the  states.  A  belief  about  the  states  is  consistent 


with  the  signal.  The  utility  function  is  defined  over  the  pairs 
of  action  and  state. 

The  Perfect  Bayes-Nash  equilibrium  (PBE)  is  a  refinement 
of  Nash  Equilibrium  in  Bayesian  games.  PBE  requires  the 
subsequent  plays  to  be  optimal  (sequential  rationale)  and 
belief  system  to  be  consistent  for  a  given  strategy  profile.  In 
particular,  a  PBE  demands  that  the  belief  system  pl{9)  satisfies 
the  Bayesian  conditions  [4]. 

Deeinition  4:  ([4],  p331-332)  The  Bayesian  conditions 
defined  for  PBE  are 

B(i):  Posterior  beliefs  are  independent.  For  history 

B(ii);  Bayes’  rule  is  used  to  update  beliefs  whenever  possi¬ 
ble. 

B(iii):  Nodes  do  not  signal  what  they  do  not  know. 

B(iv):  Posterior  beliefs  are  consistent  for  all  nodes  with  a 
common  joint  distribution  on  6  given  ifdf 

III.  Attacker  Detection  Game 
A.  Game  model 

To  abstract  the  interactions  among  the  nodes,  we  consider 
a  two-player  game  played  by  the  potential  attacker  node  i  and 
the  regular  node  j.  This  game  can  be  constructed  within  an 
application  context  of  packet  forwarding  [3],  [5].  However,  the 
regular  node  cannot  tell  if  node  i  is  an  attacker  or  not,  instead  it 
can  only  detect  the  attacker  through  observations.  The  process 
of  detecting  attackers  can  be  modeled  as  a  Bayesian  game. 
In  this  game,  the  types  of  these  nodes,  Oi  and  9j,  are  private 
information.  While  9j  =  0,  i.e.,  always  regular,  9i  can  be 
either  1  (attacker)  or  0  (regular),  depending  on  its  true  type. 
Since  the  type  of  node  i  is  hidden,  and  the  observation  is  not 
accurate  due  to  noise  and  etc.,  it  is  a  Bayesian  game  with 
imperfect  information. 

The  action  profiles  Oi  available  to  node  i  are  based  on 
its  type.  For  9i  =  0,  Ui  =  {Cooperate}.  For  9i  =  1, 
Oi  G  {Attack,  Cooperate},  i..e,  an  attacker  can  camouflage 
as  regular.  Node  j  has  the  option  to  monitor  if  node  i  is 
attacking  or  not,  thus  aj  G  {Monitor,  Idle}. 

To  further  construct  the  game,  we  define  the  following  val¬ 
ues.  Let  UA  be  the  payoff  of  a  attacker  node  if  it  successfully 
attacks.  The  cost  associated  with  such  an  attack  is  ca.  For  the 
regular  node  j,  the  cost  of  monitoring  is  um  and  0  if  it  is 
idle.  Hence,  for  the  action  profile  (oj,  aj)  =  {Attack,  Idle), 
the  net  utility  for  a  successful  attacking  node  i  is  ua  —  ca, 
the  loss  for  node  j  is  —ua  due  to  the  attack.  Similarly,  if  the 
action  profile  is  (uj,  aj)  =  {Attack,  Monitor),  the  attacker 
node  i  losses  ua  +  ca,  and  the  net  gain  for  node  j  is  ua  —  um- 
However,  if  an  attacker  node  chooses  not  to  attack,  the  cost 
to  cooperate  is  uc.  Based  on  the  types  of  node  i  and  node  j, 
the  payoffs  matrices  are  presented  in  Table  I. 

In  addition,  in  our  model,  the  channel  unreliability  implies 
that  monitoring  can  be  accurate  with  probability  1  —  p^.  We 
also  denote  7  as  the  attack  success  rate  and  a  as  the  false 
alarm  rate  due  to  the  limitation  of  the  monitoring  device. 
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(a)  8i  =  I,  attacker 


Node  i 


Attack 

Cooperate 


Node  j 

Monitor  Idle 


-UA  —  CA  UA  -  Um 

UA  -  CA  -UA 

-Uc  —Um 

-uc  0 

(b)  0i  =  0,  regular 

Node  j 

Monitor  Idle 

Node  i  Cooperate  |  —uq  —um  \  ~  0~~| 


TABLE  I 

Payoff  matrix  of  attacker  detection  game. 


B.  Bayesian  games  and  belief  update 


Our  game  analysis  is  based  on  the  following  reasoning. 
First,  it  is  not  efficient  for  the  regular  to  monitor  all  times 
because  monitoring  is  costly,  instead,  it  monitors  with  a 
probability.  On  the  other  hand,  the  attacker  node  does  not 
always  attack  in  order  to  avoid  detection.  In  the  case  it  is 
not  attacking,  it  camouflages  as  a  regular  node  and  cannot 
be  identified.  When  node  j  is  monitoring,  it  forms  a  belief 
about  node  i  on  whether  it  is  an  attacker  or  not.  This  belief 
is  updated  over  time  whenever  node  i  is  observed  to  be  an 
attacker.  With  the  above  discussions,  we  apply  Bayes  rules  to 
obtain  the  belief  update  system  for  node  j.  We  denote  in  the 
{t+  stage,  q  as  the  monitoring  rate,  0  =  {0, 1},  di{t)  is 
the  observed  actions  available  to  node  j.  The  observations  are 
private  and  subject  to  noise  and  error.  In  particular,  we  have: 


m  = 


p.f\0ypid^it)\9y 
'Ef&e  Bf\0i)p{dyt)\ey^ 


(1) 


where  P(-)  denotes  the  probability. 

For  each  of  the  terms  in  (1),  we  have  the  following 
equations,  where  A  and  C  denote  Attack  and  Cooperate 
respectively. 


P{di{t)  =  A\0i  =  1)  =  p{l  -Pe)  +  (1  -p)oi  (2) 

P{dyf)  =  A\0,  =  0)  =  a  (3) 

P{di{t)  =  C\0i  =  1)  =  ppe  +  (1  -  p)(l  -  a)  (4) 

P{dyt)  =  C\0i  =  O)  =  l-a.  (5) 


C.  Nested  belief  and  Markov  Perfect  Bayes-Nash  Equilibrium 

It  is  natural  that  not  only  the  regular  node  but  also  the 
attacker  node  (node  i)  study  the  game  through  observation. 
In  particular,  node  i  understands  that  although  the  unreliable 
channel  makes  the  observations  inaccurate,  the  more  often  it 
attacks,  the  quicker  node  j  can  form  a  correct  belief  about 
its  attacker  type.  Thus,  node  j  should  take  different  strategies 
when  different  beliefs  are  held  by  node  j.  These  strategies  are 
Markovian  when  we  view  the  beliefs  as  a  set  of  states.  The 
Markovian  strategies  adopted  by  node  i  is  only  determined 
by  the  current  state  of  the  belief,  i.e.,  when  the  belief  update 
process  takes  place.  However,  the  belief  held  by  node  j  is  its 
private  information,  and  by  no  means  can  node  i  access  this 
information.  Therefore,  it  is  essential  for  node  i  to  construct 
its  own  belief  system,  which  is  the  belief  on  the  belief  node 
j  holds  towards  node  i  and  we  call  this  belief  developed  by 
node  i  nested  belief. 

We  denote  p.i{p,j{0i))  as  the  nested  belief  node  i  holds  about 
node  j’s  belief  about  node  i,  i.e.,  ij.i{pj{0i))  is  the  belief  about 
Pj{0i).  For  the  game  we  presented  in  Table  1(a),  depending 
on  the  actions  nodes  i  and  j  take,  the  payoff  of  node  i,  Ui, 
can  be  one  of  the  three  different  values:  —ua  —  ca,  ua  —  ca 
or  —uc-  While  the  observations  of  the  payoffs  are  node  Fs 
private  information,  given  a  specific  observation  Oi,  node  i 
can  predict  the  actions  taken  by  node  j,  despite  the  prediction 
may  be  inaccurate.  For  example,  when  Oi  =  —ua  —  ca,  node 
i  knows  for  sure  aj  =  Monitor.  However,  when  Oi  =  —uq, 
node  i  cannot  tell  what  node  i  has  done.  Further,  based 
on  the  prediction  of  the  actions  node  j  takes,  node  i  can 
update  its  belief  pi{pj{0i))  on  how  node  j’s  belief  Pj{0i) 
has  changed  due  to  oy.  Continuing  with  the  same  examples, 
when  Oi  =  —ua  —  ca,  clj  =  Monitor,  so  node  j  observes  the 
Attack  launched  by  node  i  and  it  will  update  Pj(0i)  according 
to  equation  1.  Similarly,  when  Oi  =  ua  —  ca,  node  i  knows 
that  node  j  is  idle  and  Pj{0i)  will  not  change.  However,  the 
uncertainty  comes  when  Oi  =  —uc,  where  node  i  cannot 
accurately  update  its  belief  about  Pj{0i). 


Since  node  j  does  not  monitor  node  Fs  actions  at  every 
stage,  when  node  j  is  not  monitoring,  its  belief  remains  the 
same  at  the  next  stage.  Thus,  (1)  is  revised  as: 


(*+l)  (n  \  _ 

[01.)  —  0, 


pf\0yp{dym)  ,  ,, 

— 7— - ^  +  (1  -  q)Bk{^i)- 

Ef^eP?i0i)Pidym) 

(6) 

With  the  belief  system,  the  games  are  played  in  a  sequential 
manner.  As  the  game  evolves,  neither  nodes  can  stick  to  the 
very  same  strategy  at  every  stage  to  yield  the  most  payoffs. 
Thus,  the  best  response  strategies  are  dependent  on  the  current 
beliefs  held  by  the  nodes.  Perfect  Bayesian  Equilibrium  (PBE) 
can  be  applied  to  characterize  the  aforementioned  dependency. 
In  PBE,  the  belief  system  is  updated  by  Bayes’  rule.  PBE 
also  demands  that  the  optimality  of  subsequent  play  given  the 
belief.  The  details  of  obtaining  PBE  is  presented  in  [13],  and 
it  is  not  the  focus  of  this  paper. 


To  construct  the  belief  update  system  for  node  i,  we  employ 
the  Bayes’  Theorem.  At  stage  t  of  the  game,  based  on  the 
observation  of\  node  Fs  belief  pLi{0i)  is  updated  as: 


P^\p,{0f))p{o^y\0i) 


i:f^ei^\i^3mno'i>\0i) 


(i)| 


(7) 


where  0={O,1}. 

The  conditional  probabilities  of  observing  Oi  given  its  type 
0i  can  be  calculated  as  follows.  To  distinguish  from  the 
strategy  profiles  we  used  previously,  we  denote  p  as  the 
probability  node  i  launches  attacks,  and  q  as  the  probability 
node  j  monitors.  Therefore,  the  probabilities  that  arise  due  to 
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the  different  observations  and  node  i’s  type  are: 


P(of  = 

-UA 

-  CA\di 

=  1) 

=  pq{l  - 

'  Pe)  +  (1  ■ 

-p)qa 

(8) 

P(of)  = 

-UA 

-  CA\0i 

=  0) 

=  qa 

(9) 

P(o«  = 

UA  - 

CA\0i  = 

i)  = 

p[qpe  + 

(1-7)] 

(10) 

P(of)  = 

UA  - 

CA\0i  = 

0)  = 

0 

(11) 

P(o«  = 

-uc\ 

0i  =  l) 

=  (i 

-p)[q{^ 

—  ct)  -f  (1 

-7)] 

(12) 

P(of)  = 

-uc\ 

e^  =  o) 

=  (i 

-  a)q. 

(13) 

With  the 

above  equations,  for  each  of 

'  the  observations 

Oi  € 

O,  where  O  =  {-ua  -  ca,  ua  -  ca,  -  uc}, 
updated  independently.  Since  for  the  attacker  node  i,  its  type 
=  1  is  known  to  itself,  the  overall  belief  is  hence  updated 
considering  each  of  the  possible  observations. 


E  ii) 

Oi€0 


(14) 


Further,  with  the  belief  system  of  node  i,  the  attacker 
detection  game  can  be  solved  obtain  the  sequential  rationality. 
Moreover,  it  is  justified  that  the  belief  update  process  for  node 
i  also  satisfies  the  Bayesian  condition  in  Definition  4.  The 
reasons  are:  B(i)  is  satisfied  because  9j  —  0  all  the  time. 
Equation  (7)  is  derived  from  Bayes’  rule,  and  hence  B(ii) 
is  also  satisfied.  B(iii)  is  fulfilled  because  node  i’s  observed 
signals  is  determined  by  its  actions.  B(iv)  is  trivial  in  our 
game  because  no  third  player  exists.  In  addition,  equation 
(15)  suggests  that  node  i’s  strategy  is  purely  dependent  on  the 
current  belief  it  holds.  Thus,  we  can  further  refine  the  PBE  in 
attacker  detection  game. 

Solving  the  game,  we  get  a  Markov  Perfect  Bayes-Nash 
Equilibrium  (MPBNE),  with  the  equilibrium  profile  as  in  the 
following  theorem. 


Theorem  1:  The  attacker  detection  game  has  a  MPBNE 
for  subgame  stage  k  when 

(fc)  _  UM 


p'  '  = 


~,(k)  _ 


-  ca  +  uc 


7)(1  -Pe) 


(15) 


(16) 


MA(l-Pe)(l  +  7) 

Proof:  Please  refer  to  the  Appendix  ■ 

A  special  case  for  the  strategy  profile  (7^  is  “Always  attack 
when  pLf\pLj{6i  =  1))  <  /i  and  cooperate  otherwise,  for 
a  predefined  threshold  /i  €(0,  1)”.  In  this  strategy,  when 
=  1))  <  P  =  1  ^nd  node  j  will  progressively 
update  its  belief  when  it  monitors  because  node  i  is  always 
behaving  maliciously.  However,  when  the  belief  threshold 
is  reached,  node  i  will  refrain  from  launching  attacks,  and 
hence  its  payoff  will  decrease.  It  is  clear  that  the  strategy 
deviates  from  the  MPBNE  because  p  does  not  adhere  to  the 
equilibrium.  As  a  result,  node  i  will  be  identified  quickly  and 
it  will  be  dormant  for  the  rest  of  the  time.  While  this  strategy  is 
favorable  to  node  j  and  the  network,  from  node  i’s  perspective, 
this  strategy  will  limit  its  attacks  and  hence  it  is  not  desirable. 


IV.  Simulation 

We  study  the  characteristics  of  the  Markov  Perfect  Bayes- 
Nash  Equilibrium.  In  particular,  we  are  interested  in  the 
properties  of  node  i’s  belief  update  system  (i.e.,  nested  belief) 
and  how  the  results  would  differ  from  that  without  node  i’s 
belief.  It  is  noted  that  for  node  j’s  belief  system,  a  complete 
study  can  be  found  in  [13]. 

In  Eigure  1,  we  study  node  i’s  belief  system  in  the  MPBNE. 

The  plots  are  obtained  with  =  0.01,  7  =  0.95  and  a  = 

0.05.  To  better  show  the  properties  of  node  i’s  belief  system 
in  the  MPBNE,  we  also  present  node  j’s  belief  system.  In 
particular,  we  plot  pi  as  node  i’s  belief  system  in  MPBNE 

according  to  equation  (14),  as  node  j’s  belief  system  in 

PBE  as  stated  in  equation  (6)  and  p*  as  node  j’s  belief  system 
update  in  the  MPBNE  as  a  result  of  node  i’s  actions  in  the 
nested  belief  model.  A  common  observation  is  that  node  i’s 
belief  pi  converges  much  faster  than  the  belief  pj  in  PBE, 
which  means  that  node  i  holds  a  false  belief  that  node  j  can 
identify  its  malice  quicker  than  node  j  actually  could.  As  a 
result  of  the  inaccuracy  in  node  i’s  belief,  it  takes  longer  time 
for  node  j  to  form  a  belief  on  node  i.  This  is  evident  from 
the  plots  that  show  p*  converges  much  slowly  than  it  does  in 
PBE,  when  node  i  does  not  employ  any  belief  system. 

In  addition,  Eigure  1(b)  indicates  a  larger  detection  gain  will 
force  node  i’s  belief  system  converge  quicker.  Eigures  1(c)  and 
1(d)  infer  that  reliable  channel,  high  attack  success  rate  and 
accurate  detection  (low  false  alarm  rate)  will  also  induce  a 
fast  convergence  of  pi.  Moreover,  a  high  disguise  cost  helps 
Pi  converge  faster.  The  reason  lies  in  the  inaccuracy  of  node 
i’s  belief  system.  Erom  our  previous  discussion,  it  is  stated 
that  when  the  observed  payoff  is  —uc,  node  i  cannot  predict 
what  node  j’s  action  is.  Thus,  an  internal  error  resides  in  node 
i’s  belief  system,  and  this  error  is  amplified  when  uc  is  large 
(i.e.,  Uc,  takes  a  high  weight  in  the  payoff),  which  corresponds 
to  a  large  disguise  cost. 

The  properties  of  the  MPBNE  strategy  are  further  investi¬ 
gated  in  Eigure  2.  Both  the  MPBNE  strategy  attack  probability, 
denoted  as  pn  and  the  PBE  strategy  attack  probability  will 
increase  with  smaller  attack  gain  and  attack  success  rate,  as 
well  as  larger  channel  error  rate  and  false  alarm  rate.  Moreover, 
it  is  noted  that  pn  is  smaller  than  what  node  j  believes  it 
would  be  (denoted  as  in  the  Eigures  2(a)).  In  addition. 
Pm  is  larger  than  the  PBE  strategy  attack  probability  ppbe  in 
the  first  several  stage  games,  however,  as  the  games  repeat. 
Pm  drops  below  Ppbe-  This  interesting  observation  implies  that 
when  node  i  implements  the  belief  system,  it  attacks  more 
aggressively  (than  without  the  belief  about  belief  model,  i.e., 
in  PBE)  in  the  first  several  games,  because  it  believes  node  j  is 
far  from  reaching  a  successful  detection.  As  the  game  unfolds, 
node  i  adjusts  its  attack  rate  to  prevent  from  detection.  The 
difference  between  pm  and  ppbe  also  explains  why  node  j’s 
belief  system  alters  in  the  MPBNE  as  shown  in  Eigure  1. 

V.  Conclusions 

In  this  paper,  we  apply  game  theory  to  study  attacker  detec¬ 
tion  in  wireless  networks  with  lossy  channels.  We  formulate  an 
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Fig.  1.  Node  i's  belief  system  update  in  the  Markov  Perfect  Bayes-Nash 
Equilibrium. 


number  of  games  played  (t)  number  of  games  played  (1) 


(a)  attack  gain  (b)  channel  unreliability,  attack  suc¬ 

cess  rate  and  false  alarm  rate 

Fig.  2.  Effect  of  parameters  on  the  Markov  Perfect  Bayes-Nash  Equilibrium 
strategy. 

attacker  detection  game  and  apply  Bayes  analysis  to  obtain  the 
equilibria  with  imperfect  information.  We  introduce  the  nested 
belief  model  as  countermeasures  available  to  the  attackers. 
MPBNE  is  derived  and  it  postpone  the  detection  of  attackers. 
Simulations  are  provided  to  illustrate  the  properties  of  the 
equilibrium  in  terms  of  disguise  cost,  attack  success  rate, 
detection  gain,  attack  gain,  channel  loss,  and  false  alarm  rate. 
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Appendix 

Theorem  1:  The  attacker  detection  game  has  a  MPBNE 
for  subgame  stage  k  when 

p(k)  ^  ^ _ 

=  1))WA(1  +  7)(1-Pe) 

~(fe)  _  UAl  -  CA  +  Uc 

^  Ua{1- Pe){l  +  iy 

Proof:  Consider  at  an  arbitrary  stage  k  of  the  game, 
the  equilibrium  point  infers  indifference,  which  means 
uf  {Attack)  =  uf  {Cooperate)  and  uf  {Monitor)  = 
uf{Idle).  In  particular, 

uf{af  =  Attack\af  =  Monitor)  = 

-{UA  +  Ca){1  -  Pe)^’'^  +  {UA  -  Ca)7(1  “  7^^) 

+  {UA  -  CA)77^^Pe  -  Ca(1  -  l)Pe7’"^ 

-CA(l-g("7(l-7)  (17) 

uf{af  =  Cooperate\af  =  Monitor)  =  —uq-  (18) 
uf{af  =  Monitor\af  =  Attack)  = 

Pi{ff{0i  =  -  mm)(1  -Pe) 

+  (1  -  7)(1  -pe){uA  -  Um)  -  (1  -  l)PeUM 
-7Pe{uA  +  Um)]  -  {I  -  P^’^ypLi{ff  {9i  =  1))'UM 


Pi{pf\0i  =  0))mm 

(19) 

[af  =  Idle\af  =  Attack)  = 

-ft'^'’UAlPi{ff{0i  =  1)). 

(20) 

The  solutions  to  the  above  equations  are  the  and 
values  in  the  theorem,  which  indicate  the  sequential  rationality. 
In  addition,  our  discussion  of  the  nested  belief  shows  that  node 
Es  belief  update  satisfies  the  Bayesian  conditions.  Thus,  p^^'> 
and  are  the  MPBNE  solution  to  the  attacker  detection 
game.  ■ 
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